Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-24427 EUVD-2023-0586GHSA-x9q4-qwfh-9gjq

Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin

Published Jan 24, 2023 · Updated Apr 2, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Bitbucket OAuth Plugin Package: org.jenkins-ci.plugins:bitbucket-oauth Category: Web / CMS Ecosystem: Maven

Description

Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Bitbucket OAuth Plugin unspecified – ≤ 0.12 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:bitbucket-oauth < 0.13 0.13 GHSA-x9q4-qwfh-9gjq

Advisories 1

References